1/*
2 * respip/respip.c - filtering response IP module
3 */
4
5/**
6 * \file
7 *
8 * This file contains a module that inspects a result of recursive resolution
9 * to see if any IP address record should trigger a special action.
10 * If applicable these actions can modify the original response.
11 */
12#include "config.h"
13
14#include "services/localzone.h"
15#include "services/authzone.h"
16#include "services/cache/dns.h"
17#include "sldns/str2wire.h"
18#include "util/config_file.h"
19#include "util/fptr_wlist.h"
20#include "util/module.h"
21#include "util/net_help.h"
22#include "util/regional.h"
23#include "util/data/msgreply.h"
24#include "util/storage/dnstree.h"
25#include "respip/respip.h"
26#include "services/view.h"
27#include "sldns/rrdef.h"
28
29
30/** Subset of resp_addr.node, used for inform-variant logging */
31struct respip_addr_info {
32 struct sockaddr_storage addr;
33 socklen_t addrlen;
34 int net;
35};
36
37/** Query state regarding the response-ip module. */
38enum respip_state {
39 /**
40 * The general state. Unless CNAME chasing takes place, all processing
41 * is completed in this state without any other asynchronous event.
42 */
43 RESPIP_INIT = 0,
44
45 /**
46 * A subquery for CNAME chasing is completed.
47 */
48 RESPIP_SUBQUERY_FINISHED
49};
50
51/** Per query state for the response-ip module. */
52struct respip_qstate {
53 enum respip_state state;
54};
55
56struct respip_set*
57respip_set_create(void)
58{
59 struct respip_set* set = calloc(1, sizeof(*set));
60 if(!set)
61 return NULL;
62 set->region = regional_create();
63 if(!set->region) {
64 free(set);
65 return NULL;
66 }
67 addr_tree_init(&set->ip_tree);
68 lock_rw_init(&set->lock);
69 return set;
70}
71
72/** helper traverse to delete resp_addr nodes */
73static void
74resp_addr_del(rbnode_type* n, void* ATTR_UNUSED(arg))
75{
76 struct resp_addr* r = (struct resp_addr*)n->key;
77 lock_rw_destroy(&r->lock);
78#ifdef THREADS_DISABLED
79 (void)r;
80#endif
81}
82
83void
84respip_set_delete(struct respip_set* set)
85{
86 if(!set)
87 return;
88 lock_rw_destroy(&set->lock);
89 traverse_postorder(&set->ip_tree, resp_addr_del, NULL);
90 regional_destroy(set->region);
91 free(set);
92}
93
94struct rbtree_type*
95respip_set_get_tree(struct respip_set* set)
96{
97 if(!set)
98 return NULL;
99 return &set->ip_tree;
100}
101
102struct resp_addr*
103respip_sockaddr_find_or_create(struct respip_set* set, struct sockaddr_storage* addr,
104 socklen_t addrlen, int net, int create, const char* ipstr)
105{
106 struct resp_addr* node;
107 node = (struct resp_addr*)addr_tree_find(&set->ip_tree, addr, addrlen, net);
108 if(!node && create) {
109 node = regional_alloc_zero(set->region, sizeof(*node));
110 if(!node) {
111 log_err("out of memory");
112 return NULL;
113 }
114 lock_rw_init(&node->lock);
115 node->action = respip_none;
116 if(!addr_tree_insert(&set->ip_tree, &node->node, addr,
117 addrlen, net)) {
118 /* We know we didn't find it, so this should be
119 * impossible. */
120 log_warn("unexpected: duplicate address: %s", ipstr);
121 }
122 }
123 return node;
124}
125
126void
127respip_sockaddr_delete(struct respip_set* set, struct resp_addr* node)
128{
129 struct resp_addr* prev;
130 prev = (struct resp_addr*)rbtree_previous((struct rbnode_type*)node);
131 lock_rw_destroy(&node->lock);
132 rbtree_delete(&set->ip_tree, node);
133 /* no free'ing, all allocated in region */
134 if(!prev)
135 addr_tree_init_parents((rbtree_type*)set);
136 else
137 addr_tree_init_parents_node(&prev->node);
138}
139
140/** returns the node in the address tree for the specified netblock string;
141 * non-existent node will be created if 'create' is true */
142static struct resp_addr*
143respip_find_or_create(struct respip_set* set, const char* ipstr, int create)
144{
145 struct sockaddr_storage addr;
146 int net;
147 socklen_t addrlen;
148
149 if(!netblockstrtoaddr(ipstr, 0, &addr, &addrlen, &net)) {
150 log_err("cannot parse netblock: '%s'", ipstr);
151 return NULL;
152 }
153 return respip_sockaddr_find_or_create(set, &addr, addrlen, net, create,
154 ipstr);
155}
156
157static int
158respip_tag_cfg(struct respip_set* set, const char* ipstr,
159 const uint8_t* taglist, size_t taglen)
160{
161 struct resp_addr* node;
162
163 if(!(node=respip_find_or_create(set, ipstr, 1)))
164 return 0;
165 if(node->taglist) {
166 log_warn("duplicate response-address-tag for '%s', overridden.",
167 ipstr);
168 }
169 node->taglist = regional_alloc_init(set->region, taglist, taglen);
170 if(!node->taglist) {
171 log_err("out of memory");
172 return 0;
173 }
174 node->taglen = taglen;
175 return 1;
176}
177
178/** set action for the node specified by the netblock string */
179static int
180respip_action_cfg(struct respip_set* set, const char* ipstr,
181 const char* actnstr)
182{
183 struct resp_addr* node;
184 enum respip_action action;
185
186 if(!(node=respip_find_or_create(set, ipstr, 1)))
187 return 0;
188 if(node->action != respip_none) {
189 verbose(VERB_QUERY, "duplicate response-ip action for '%s', overridden.",
190 ipstr);
191 }
192 if(strcmp(actnstr, "deny") == 0)
193 action = respip_deny;
194 else if(strcmp(actnstr, "redirect") == 0)
195 action = respip_redirect;
196 else if(strcmp(actnstr, "inform") == 0)
197 action = respip_inform;
198 else if(strcmp(actnstr, "inform_deny") == 0)
199 action = respip_inform_deny;
200 else if(strcmp(actnstr, "inform_redirect") == 0)
201 action = respip_inform_redirect;
202 else if(strcmp(actnstr, "always_transparent") == 0)
203 action = respip_always_transparent;
204 else if(strcmp(actnstr, "always_refuse") == 0)
205 action = respip_always_refuse;
206 else if(strcmp(actnstr, "always_nxdomain") == 0)
207 action = respip_always_nxdomain;
208 else if(strcmp(actnstr, "always_nodata") == 0)
209 action = respip_always_nodata;
210 else if(strcmp(actnstr, "always_deny") == 0)
211 action = respip_always_deny;
212 else {
213 log_err("unknown response-ip action %s", actnstr);
214 return 0;
215 }
216 node->action = action;
217 return 1;
218}
219
220/** allocate and initialize an rrset structure; this function is based
221 * on new_local_rrset() from the localzone.c module */
222static struct ub_packed_rrset_key*
223new_rrset(struct regional* region, uint16_t rrtype, uint16_t rrclass)
224{
225 struct packed_rrset_data* pd;
226 struct ub_packed_rrset_key* rrset = regional_alloc_zero(
227 region, sizeof(*rrset));
228 if(!rrset) {
229 log_err("out of memory");
230 return NULL;
231 }
232 rrset->entry.key = rrset;
233 pd = regional_alloc_zero(region, sizeof(*pd));
234 if(!pd) {
235 log_err("out of memory");
236 return NULL;
237 }
238 pd->trust = rrset_trust_prim_noglue;
239 pd->security = sec_status_insecure;
240 rrset->entry.data = pd;
241 rrset->rk.dname = regional_alloc_zero(region, 1);
242 if(!rrset->rk.dname) {
243 log_err("out of memory");
244 return NULL;
245 }
246 rrset->rk.dname_len = 1;
247 rrset->rk.type = htons(rrtype);
248 rrset->rk.rrset_class = htons(rrclass);
249 return rrset;
250}
251
252/** enter local data as resource records into a response-ip node */
253
254int
255respip_enter_rr(struct regional* region, struct resp_addr* raddr,
256 uint16_t rrtype, uint16_t rrclass, time_t ttl, uint8_t* rdata,
257 size_t rdata_len, const char* rrstr, const char* netblockstr)
258{
259 struct packed_rrset_data* pd;
260 struct sockaddr* sa;
261 sa = (struct sockaddr*)&raddr->node.addr;
262 if (rrtype == LDNS_RR_TYPE_CNAME && raddr->data) {
263 log_err("CNAME response-ip data (%s) can not co-exist with other "
264 "response-ip data for netblock %s", rrstr, netblockstr);
265 return 0;
266 } else if (raddr->data &&
267 raddr->data->rk.type == htons(LDNS_RR_TYPE_CNAME)) {
268 log_err("response-ip data (%s) can not be added; CNAME response-ip "
269 "data already in place for netblock %s", rrstr, netblockstr);
270 return 0;
271 } else if((rrtype != LDNS_RR_TYPE_CNAME) &&
272 ((sa->sa_family == AF_INET && rrtype != LDNS_RR_TYPE_A) ||
273 (sa->sa_family == AF_INET6 && rrtype != LDNS_RR_TYPE_AAAA))) {
274 log_err("response-ip data %s record type does not correspond "
275 "to netblock %s address family", rrstr, netblockstr);
276 return 0;
277 }
278
279 if(!raddr->data) {
280 raddr->data = new_rrset(region, rrtype, rrclass);
281 if(!raddr->data)
282 return 0;
283 }
284 pd = raddr->data->entry.data;
285 return rrset_insert_rr(region, pd, rdata, rdata_len, ttl, rrstr);
286}
287
288static int
289respip_enter_rrstr(struct regional* region, struct resp_addr* raddr,
290 const char* rrstr, const char* netblock)
291{
292 uint8_t* nm;
293 uint16_t rrtype = 0, rrclass = 0;
294 time_t ttl = 0;
295 uint8_t rr[LDNS_RR_BUF_SIZE];
296 uint8_t* rdata = NULL;
297 size_t rdata_len = 0;
298 char buf[65536];
299 char bufshort[64];
300 int ret;
301 if(raddr->action != respip_redirect
302 && raddr->action != respip_inform_redirect) {
303 log_err("cannot parse response-ip-data %s: response-ip "
304 "action for %s is not redirect", rrstr, netblock);
305 return 0;
306 }
307 ret = snprintf(buf, sizeof(buf), ". %s", rrstr);
308 if(ret < 0 || ret >= (int)sizeof(buf)) {
309 strlcpy(bufshort, rrstr, sizeof(bufshort));
310 log_err("bad response-ip-data: %s...", bufshort);
311 return 0;
312 }
313 if(!rrstr_get_rr_content(buf, &nm, &rrtype, &rrclass, &ttl, rr, sizeof(rr),
314 &rdata, &rdata_len)) {
315 log_err("bad response-ip-data: %s", rrstr);
316 return 0;
317 }
318 free(nm);
319 return respip_enter_rr(region, raddr, rrtype, rrclass, ttl, rdata,
320 rdata_len, rrstr, netblock);
321}
322
323static int
324respip_data_cfg(struct respip_set* set, const char* ipstr, const char* rrstr)
325{
326 struct resp_addr* node;
327
328 node=respip_find_or_create(set, ipstr, 0);
329 if(!node || node->action == respip_none) {
330 log_err("cannot parse response-ip-data %s: "
331 "response-ip node for %s not found", rrstr, ipstr);
332 return 0;
333 }
334 return respip_enter_rrstr(set->region, node, rrstr, ipstr);
335}
336
337static int
338respip_set_apply_cfg(struct respip_set* set, char* const* tagname, int num_tags,
339 struct config_strbytelist* respip_tags,
340 struct config_str2list* respip_actions,
341 struct config_str2list* respip_data)
342{
343 struct config_strbytelist* p;
344 struct config_str2list* pa;
345 struct config_str2list* pd;
346
347 set->tagname = tagname;
348 set->num_tags = num_tags;
349
350 p = respip_tags;
351 while(p) {
352 struct config_strbytelist* np = p->next;
353
354 log_assert(p->str && p->str2);
355 if(!respip_tag_cfg(set, p->str, p->str2, p->str2len)) {
356 config_del_strbytelist(p);
357 return 0;
358 }
359 free(p->str);
360 free(p->str2);
361 free(p);
362 p = np;
363 }
364
365 pa = respip_actions;
366 while(pa) {
367 struct config_str2list* np = pa->next;
368 log_assert(pa->str && pa->str2);
369 if(!respip_action_cfg(set, pa->str, pa->str2)) {
370 config_deldblstrlist(pa);
371 return 0;
372 }
373 free(pa->str);
374 free(pa->str2);
375 free(pa);
376 pa = np;
377 }
378
379 pd = respip_data;
380 while(pd) {
381 struct config_str2list* np = pd->next;
382 log_assert(pd->str && pd->str2);
383 if(!respip_data_cfg(set, pd->str, pd->str2)) {
384 config_deldblstrlist(pd);
385 return 0;
386 }
387 free(pd->str);
388 free(pd->str2);
389 free(pd);
390 pd = np;
391 }
392 addr_tree_init_parents(&set->ip_tree);
393
394 return 1;
395}
396
397int
398respip_global_apply_cfg(struct respip_set* set, struct config_file* cfg)
399{
400 int ret = respip_set_apply_cfg(set, cfg->tagname, cfg->num_tags,
401 cfg->respip_tags, cfg->respip_actions, cfg->respip_data);
402 cfg->respip_data = NULL;
403 cfg->respip_actions = NULL;
404 cfg->respip_tags = NULL;
405 return ret;
406}
407
408/** Iterate through raw view data and apply the view-specific respip
409 * configuration; at this point we should have already seen all the views,
410 * so if any of the views that respip data refer to does not exist, that's
411 * an error. This additional iteration through view configuration data
412 * is expected to not have significant performance impact (or rather, its
413 * performance impact is not expected to be prohibitive in the configuration
414 * processing phase).
415 */
416int
417respip_views_apply_cfg(struct views* vs, struct config_file* cfg,
418 int* have_view_respip_cfg)
419{
420 struct config_view* cv;
421 struct view* v;
422 int ret;
423
424 for(cv = cfg->views; cv; cv = cv->next) {
425
426 /** if no respip config for this view then there's
427 * nothing to do; note that even though respip data must go
428 * with respip action, we're checking for both here because
429 * we want to catch the case where the respip action is missing
430 * while the data is present */
431 if(!cv->respip_actions && !cv->respip_data)
432 continue;
433
434 if(!(v = views_find_view(vs, cv->name, 1))) {
435 log_err("view '%s' unexpectedly missing", cv->name);
436 return 0;
437 }
438 if(!v->respip_set) {
439 v->respip_set = respip_set_create();
440 if(!v->respip_set) {
441 log_err("out of memory");
442 lock_rw_unlock(&v->lock);
443 return 0;
444 }
445 }
446 ret = respip_set_apply_cfg(v->respip_set, NULL, 0, NULL,
447 cv->respip_actions, cv->respip_data);
448 lock_rw_unlock(&v->lock);
449 if(!ret) {
450 log_err("Error while applying respip configuration "
451 "for view '%s'", cv->name);
452 return 0;
453 }
454 *have_view_respip_cfg = (*have_view_respip_cfg ||
455 v->respip_set->ip_tree.count);
456 cv->respip_actions = NULL;
457 cv->respip_data = NULL;
458 }
459 return 1;
460}
461
462/**
463 * make a deep copy of 'key' in 'region'.
464 * This is largely derived from packed_rrset_copy_region() and
465 * packed_rrset_ptr_fixup(), but differs in the following points:
466 *
467 * - It doesn't assume all data in 'key' are in a contiguous memory region.
468 * Although that would be the case in most cases, 'key' can be passed from
469 * a lower-level module and it might not build the rrset to meet the
470 * assumption. In fact, an rrset specified as response-ip-data or generated
471 * in local_data_find_tag_datas() breaks the assumption. So it would be
472 * safer not to naively rely on the assumption. On the other hand, this
473 * function ensures the copied rrset data are in a contiguous region so
474 * that it won't cause a disruption even if an upper layer module naively
475 * assumes the memory layout.
476 * - It doesn't copy RRSIGs (if any) in 'key'. The rrset will be used in
477 * a reply that was already faked, so it doesn't make much sense to provide
478 * partial sigs even if they are valid themselves.
479 * - It doesn't adjust TTLs as it basically has to be a verbatim copy of 'key'
480 * just allocated in 'region' (the assumption is necessary TTL adjustment
481 * has been already done in 'key').
482 *
483 * This function returns the copied rrset key on success, and NULL on memory
484 * allocation failure.
485 */
486static struct ub_packed_rrset_key*
487copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region)
488{
489 struct ub_packed_rrset_key* ck = regional_alloc(region,
490 sizeof(struct ub_packed_rrset_key));
491 struct packed_rrset_data* d;
492 struct packed_rrset_data* data = key->entry.data;
493 size_t dsize, i;
494 uint8_t* nextrdata;
495
496 /* derived from packed_rrset_copy_region(), but don't use
497 * packed_rrset_sizeof() and do exclude RRSIGs */
498 if(!ck)
499 return NULL;
500 ck->id = key->id;
501 memset(&ck->entry, 0, sizeof(ck->entry));
502 ck->entry.hash = key->entry.hash;
503 ck->entry.key = ck;
504 ck->rk = key->rk;
505 if(key->rk.dname) {
506 ck->rk.dname = regional_alloc_init(region, key->rk.dname,
507 key->rk.dname_len);
508 if(!ck->rk.dname)
509 return NULL;
510 ck->rk.dname_len = key->rk.dname_len;
511 } else {
512 ck->rk.dname = NULL;
513 ck->rk.dname_len = 0;
514 }
515
516 if((unsigned)data->count >= 0xffff00U)
517 return NULL; /* guard against integer overflow in dsize */
518 dsize = sizeof(struct packed_rrset_data) + data->count *
519 (sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t));
520 for(i=0; i<data->count; i++) {
521 if((unsigned)dsize >= 0x0fffffffU ||
522 (unsigned)data->rr_len[i] >= 0x0fffffffU)
523 return NULL; /* guard against integer overflow */
524 dsize += data->rr_len[i];
525 }
526 d = regional_alloc(region, dsize);
527 if(!d)
528 return NULL;
529 *d = *data;
530 d->rrsig_count = 0;
531 ck->entry.data = d;
532
533 /* derived from packed_rrset_ptr_fixup() with copying the data */
534 d->rr_len = (size_t*)((uint8_t*)d + sizeof(struct packed_rrset_data));
535 d->rr_data = (uint8_t**)&(d->rr_len[d->count]);
536 d->rr_ttl = (time_t*)&(d->rr_data[d->count]);
537 nextrdata = (uint8_t*)&(d->rr_ttl[d->count]);
538 for(i=0; i<d->count; i++) {
539 d->rr_len[i] = data->rr_len[i];
540 d->rr_ttl[i] = data->rr_ttl[i];
541 d->rr_data[i] = nextrdata;
542 memcpy(d->rr_data[i], data->rr_data[i], data->rr_len[i]);
543 nextrdata += d->rr_len[i];
544 }
545
546 return ck;
547}
548
549int
550respip_init(struct module_env* env, int id)
551{
552 (void)env;
553 (void)id;
554 return 1;
555}
556
557void
558respip_deinit(struct module_env* env, int id)
559{
560 (void)env;
561 (void)id;
562}
563
564/** Convert a packed AAAA or A RRset to sockaddr. */
565static int
566rdata2sockaddr(const struct packed_rrset_data* rd, uint16_t rtype, size_t i,
567 struct sockaddr_storage* ss, socklen_t* addrlenp)
568{
569 /* unbound can accept and cache odd-length AAAA/A records, so we have
570 * to validate the length. */
571 if(rtype == LDNS_RR_TYPE_A && rd->rr_len[i] == 6) {
572 struct sockaddr_in* sa4 = (struct sockaddr_in*)ss;
573
574 memset(sa4, 0, sizeof(*sa4));
575 sa4->sin_family = AF_INET;
576 memcpy(&sa4->sin_addr, rd->rr_data[i] + 2,
577 sizeof(sa4->sin_addr));
578 *addrlenp = sizeof(*sa4);
579 return 1;
580 } else if(rtype == LDNS_RR_TYPE_AAAA && rd->rr_len[i] == 18) {
581 struct sockaddr_in6* sa6 = (struct sockaddr_in6*)ss;
582
583 memset(sa6, 0, sizeof(*sa6));
584 sa6->sin6_family = AF_INET6;
585 memcpy(&sa6->sin6_addr, rd->rr_data[i] + 2,
586 sizeof(sa6->sin6_addr));
587 *addrlenp = sizeof(*sa6);
588 return 1;
589 }
590 return 0;
591}
592
593/**
594 * Search the given 'iptree' for response address information that matches
595 * any of the IP addresses in an AAAA or A in the answer section of the
596 * response (stored in 'rep'). If found, a pointer to the matched resp_addr
597 * structure will be returned, and '*rrset_id' is set to the index in
598 * rep->rrsets for the RRset that contains the matching IP address record
599 * (the index is normally 0, but can be larger than that if this is a CNAME
600 * chain or type-ANY response).
601 * Returns resp_addr holding read lock.
602 */
603static struct resp_addr*
604respip_addr_lookup(const struct reply_info *rep, struct respip_set* rs,
605 size_t* rrset_id)
606{
607 size_t i;
608 struct resp_addr* ra;
609 struct sockaddr_storage ss;
610 socklen_t addrlen;
611
612 lock_rw_rdlock(&rs->lock);
613 for(i=0; i<rep->an_numrrsets; i++) {
614 size_t j;
615 const struct packed_rrset_data* rd;
616 uint16_t rtype = ntohs(rep->rrsets[i]->rk.type);
617
618 if(rtype != LDNS_RR_TYPE_A && rtype != LDNS_RR_TYPE_AAAA)
619 continue;
620 rd = rep->rrsets[i]->entry.data;
621 for(j = 0; j < rd->count; j++) {
622 if(!rdata2sockaddr(rd, rtype, j, &ss, &addrlen))
623 continue;
624 ra = (struct resp_addr*)addr_tree_lookup(&rs->ip_tree,
625 &ss, addrlen);
626 if(ra) {
627 *rrset_id = i;
628 lock_rw_rdlock(&ra->lock);
629 lock_rw_unlock(&rs->lock);
630 return ra;
631 }
632 }
633 }
634 lock_rw_unlock(&rs->lock);
635 return NULL;
636}
637
638/*
639 * Create a new reply_info based on 'rep'. The new info is based on
640 * the passed 'rep', but ignores any rrsets except for the first 'an_numrrsets'
641 * RRsets in the answer section. These answer rrsets are copied to the
642 * new info, up to 'copy_rrsets' rrsets (which must not be larger than
643 * 'an_numrrsets'). If an_numrrsets > copy_rrsets, the remaining rrsets array
644 * entries will be kept empty so the caller can fill them later. When rrsets
645 * are copied, they are shallow copied. The caller must ensure that the
646 * copied rrsets are valid throughout its lifetime and must provide appropriate
647 * mutex if it can be shared by multiple threads.
648 */
649static struct reply_info *
650make_new_reply_info(const struct reply_info* rep, struct regional* region,
651 size_t an_numrrsets, size_t copy_rrsets)
652{
653 struct reply_info* new_rep;
654 size_t i;
655
656 /* create a base struct. we specify 'insecure' security status as
657 * the modified response won't be DNSSEC-valid. In our faked response
658 * the authority and additional sections will be empty (except possible
659 * EDNS0 OPT RR in the additional section appended on sending it out),
660 * so the total number of RRsets is an_numrrsets. */
661 new_rep = construct_reply_info_base(region, rep->flags,
662 rep->qdcount, rep->ttl, rep->prefetch_ttl,
663 rep->serve_expired_ttl, an_numrrsets, 0, 0, an_numrrsets,
664 sec_status_insecure);
665 if(!new_rep)
666 return NULL;
667 if(!reply_info_alloc_rrset_keys(new_rep, NULL, region))
668 return NULL;
669 for(i=0; i<copy_rrsets; i++)
670 new_rep->rrsets[i] = rep->rrsets[i];
671
672 return new_rep;
673}
674
675/**
676 * See if response-ip or tag data should override the original answer rrset
677 * (which is rep->rrsets[rrset_id]) and if so override it.
678 * This is (mostly) equivalent to localzone.c:local_data_answer() but for
679 * response-ip actions.
680 * Note that this function distinguishes error conditions from "success but
681 * not overridden". This is because we want to avoid accidentally applying
682 * the "no data" action in case of error.
683 * @param action: action to apply
684 * @param data: RRset to use for override
685 * @param qtype: original query type
686 * @param rep: original reply message
687 * @param rrset_id: the rrset ID in 'rep' to which the action should apply
688 * @param new_repp: see respip_rewrite_reply
689 * @param tag: if >= 0 the tag ID used to determine the action and data
690 * @param tag_datas: data corresponding to 'tag'.
691 * @param tag_datas_size: size of 'tag_datas'
692 * @param tagname: array of tag names, used for logging
693 * @param num_tags: size of 'tagname', used for logging
694 * @param redirect_rrsetp: ptr to redirect record
695 * @param region: region for building new reply
696 * @return 1 if overridden, 0 if not overridden, -1 on error.
697 */
698static int
699respip_data_answer(enum respip_action action,
700 struct ub_packed_rrset_key* data,
701 uint16_t qtype, const struct reply_info* rep,
702 size_t rrset_id, struct reply_info** new_repp, int tag,
703 struct config_strlist** tag_datas, size_t tag_datas_size,
704 char* const* tagname, int num_tags,
705 struct ub_packed_rrset_key** redirect_rrsetp, struct regional* region)
706{
707 struct ub_packed_rrset_key* rp = data;
708 struct reply_info* new_rep;
709 *redirect_rrsetp = NULL;
710
711 if(action == respip_redirect && tag != -1 &&
712 (size_t)tag<tag_datas_size && tag_datas[tag]) {
713 struct query_info dataqinfo;
714 struct ub_packed_rrset_key r;
715
716 /* Extract parameters of the original answer rrset that can be
717 * rewritten below, in the form of query_info. Note that these
718 * can be different from the info of the original query if the
719 * rrset is a CNAME target.*/
720 memset(&dataqinfo, 0, sizeof(dataqinfo));
721 dataqinfo.qname = rep->rrsets[rrset_id]->rk.dname;
722 dataqinfo.qname_len = rep->rrsets[rrset_id]->rk.dname_len;
723 dataqinfo.qtype = ntohs(rep->rrsets[rrset_id]->rk.type);
724 dataqinfo.qclass = ntohs(rep->rrsets[rrset_id]->rk.rrset_class);
725
726 memset(&r, 0, sizeof(r));
727 if(local_data_find_tag_datas(&dataqinfo, tag_datas[tag], &r,
728 region)) {
729 verbose(VERB_ALGO,
730 "response-ip redirect with tag data [%d] %s",
731 tag, (tag<num_tags?tagname[tag]:"null"));
732 /* use copy_rrset() to 'normalize' memory layout */
733 rp = copy_rrset(&r, region);
734 if(!rp)
735 return -1;
736 }
737 }
738 if(!rp)
739 return 0;
740
741 /* If we are using response-ip-data, we need to make a copy of rrset
742 * to replace the rrset's dname. Note that, unlike local data, we
743 * rename the dname for other actions than redirect. This is because
744 * response-ip-data isn't associated to any specific name. */
745 if(rp == data) {
746 rp = copy_rrset(rp, region);
747 if(!rp)
748 return -1;
749 rp->rk.dname = rep->rrsets[rrset_id]->rk.dname;
750 rp->rk.dname_len = rep->rrsets[rrset_id]->rk.dname_len;
751 }
752
753 /* Build a new reply with redirect rrset. We keep any preceding CNAMEs
754 * and replace the address rrset that triggers the action. If it's
755 * type ANY query, however, no other answer records should be kept
756 * (note that it can't be a CNAME chain in this case due to
757 * sanitizing). */
758 if(qtype == LDNS_RR_TYPE_ANY)
759 rrset_id = 0;
760 new_rep = make_new_reply_info(rep, region, rrset_id + 1, rrset_id);
761 if(!new_rep)
762 return -1;
763 rp->rk.flags |= PACKED_RRSET_FIXEDTTL; /* avoid adjusting TTL */
764 new_rep->rrsets[rrset_id] = rp;
765
766 *redirect_rrsetp = rp;
767 *new_repp = new_rep;
768 return 1;
769}
770
771/**
772 * apply response ip action in case where no action data is provided.
773 * this is similar to localzone.c:lz_zone_answer() but simplified due to
774 * the characteristics of response ip:
775 * - 'deny' variants will be handled at the caller side
776 * - no specific processing for 'transparent' variants: unlike local zones,
777 * there is no such a case of 'no data but name existing'. so all variants
778 * just mean 'transparent if no data'.
779 * @param qtype: query type
780 * @param action: found action
781 * @param rep:
782 * @param new_repp
783 * @param rrset_id
784 * @param region: region for building new reply
785 * @return 1 on success, 0 on error.
786 */
787static int
788respip_nodata_answer(uint16_t qtype, enum respip_action action,
789 const struct reply_info *rep, size_t rrset_id,
790 struct reply_info** new_repp, struct regional* region)
791{
792 struct reply_info* new_rep;
793
794 if(action == respip_refuse || action == respip_always_refuse) {
795 new_rep = make_new_reply_info(rep, region, 0, 0);
796 if(!new_rep)
797 return 0;
798 FLAGS_SET_RCODE(new_rep->flags, LDNS_RCODE_REFUSED);
799 *new_repp = new_rep;
800 return 1;
801 } else if(action == respip_static || action == respip_redirect ||
802 action == respip_always_nxdomain ||
803 action == respip_always_nodata ||
804 action == respip_inform_redirect) {
805 /* Since we don't know about other types of the owner name,
806 * we generally return NOERROR/NODATA unless an NXDOMAIN action
807 * is explicitly specified. */
808 int rcode = (action == respip_always_nxdomain)?
809 LDNS_RCODE_NXDOMAIN:LDNS_RCODE_NOERROR;
810
811 /* We should empty the answer section except for any preceding
812 * CNAMEs (in that case rrset_id > 0). Type-ANY case is
813 * special as noted in respip_data_answer(). */
814 if(qtype == LDNS_RR_TYPE_ANY)
815 rrset_id = 0;
816 new_rep = make_new_reply_info(rep, region, rrset_id, rrset_id);
817 if(!new_rep)
818 return 0;
819 FLAGS_SET_RCODE(new_rep->flags, rcode);
820 *new_repp = new_rep;
821 return 1;
822 }
823
824 return 1;
825}
826
827/** Populate action info structure with the results of response-ip action
828 * processing, iff as the result of response-ip processing we are actually
829 * taking some action. Only action is set if action_only is true.
830 * Returns true on success, false on failure.
831 */
832static int
833populate_action_info(struct respip_action_info* actinfo,
834 enum respip_action action, const struct resp_addr* raddr,
835 const struct ub_packed_rrset_key* ATTR_UNUSED(rrset),
836 int ATTR_UNUSED(tag), const struct respip_set* ATTR_UNUSED(ipset),
837 int ATTR_UNUSED(action_only), struct regional* region, int rpz_used,
838 int rpz_log, char* log_name, int rpz_cname_override)
839{
840 if(action == respip_none || !raddr)
841 return 1;
842 actinfo->action = action;
843 actinfo->rpz_used = rpz_used;
844 actinfo->rpz_log = rpz_log;
845 actinfo->log_name = log_name;
846 actinfo->rpz_cname_override = rpz_cname_override;
847
848 /* for inform variants, make a copy of the matched address block for
849 * later logging. We make a copy to proactively avoid disruption if
850 * and when we allow a dynamic update to the respip tree. */
851 if(action == respip_inform || action == respip_inform_deny ||
852 rpz_used) {
853 struct respip_addr_info* a =
854 regional_alloc_zero(region, sizeof(*a));
855 if(!a) {
856 log_err("out of memory");
857 return 0;
858 }
859 a->addr = raddr->node.addr;
860 a->addrlen = raddr->node.addrlen;
861 a->net = raddr->node.net;
862 actinfo->addrinfo = a;
863 }
864
865 return 1;
866}
867
868static int
869respip_use_rpz(struct resp_addr* raddr, struct rpz* r,
870 enum respip_action* action,
871 struct ub_packed_rrset_key** data, int* rpz_log, char** log_name,
872 int* rpz_cname_override, struct regional* region, int* is_rpz)
873{
874 if(r->action_override == RPZ_DISABLED_ACTION) {
875 *is_rpz = 0;
876 return 1;
877 }
878 else if(r->action_override == RPZ_NO_OVERRIDE_ACTION)
879 *action = raddr->action;
880 else
881 *action = rpz_action_to_respip_action(r->action_override);
882 if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION &&
883 r->cname_override) {
884 *data = r->cname_override;
885 *rpz_cname_override = 1;
886 }
887 *rpz_log = r->log;
888 if(r->log_name)
889 if(!(*log_name = regional_strdup(region, r->log_name)))
890 return 0;
891 *is_rpz = 1;
892 return 1;
893}
894
895int
896respip_rewrite_reply(const struct query_info* qinfo,
897 const struct respip_client_info* cinfo, const struct reply_info* rep,
898 struct reply_info** new_repp, struct respip_action_info* actinfo,
899 struct ub_packed_rrset_key** alias_rrset, int search_only,
900 struct regional* region, struct auth_zones* az)
901{
902 const uint8_t* ctaglist;
903 size_t ctaglen;
904 const uint8_t* tag_actions;
905 size_t tag_actions_size;
906 struct config_strlist** tag_datas;
907 size_t tag_datas_size;
908 struct view* view = NULL;
909 struct respip_set* ipset = NULL;
910 size_t rrset_id = 0;
911 enum respip_action action = respip_none;
912 int tag = -1;
913 struct resp_addr* raddr = NULL;
914 int ret = 1;
915 struct ub_packed_rrset_key* redirect_rrset = NULL;
916 struct rpz* r;
| 1/*
2 * respip/respip.c - filtering response IP module
3 */
4
5/**
6 * \file
7 *
8 * This file contains a module that inspects a result of recursive resolution
9 * to see if any IP address record should trigger a special action.
10 * If applicable these actions can modify the original response.
11 */
12#include "config.h"
13
14#include "services/localzone.h"
15#include "services/authzone.h"
16#include "services/cache/dns.h"
17#include "sldns/str2wire.h"
18#include "util/config_file.h"
19#include "util/fptr_wlist.h"
20#include "util/module.h"
21#include "util/net_help.h"
22#include "util/regional.h"
23#include "util/data/msgreply.h"
24#include "util/storage/dnstree.h"
25#include "respip/respip.h"
26#include "services/view.h"
27#include "sldns/rrdef.h"
28
29
30/** Subset of resp_addr.node, used for inform-variant logging */
31struct respip_addr_info {
32 struct sockaddr_storage addr;
33 socklen_t addrlen;
34 int net;
35};
36
37/** Query state regarding the response-ip module. */
38enum respip_state {
39 /**
40 * The general state. Unless CNAME chasing takes place, all processing
41 * is completed in this state without any other asynchronous event.
42 */
43 RESPIP_INIT = 0,
44
45 /**
46 * A subquery for CNAME chasing is completed.
47 */
48 RESPIP_SUBQUERY_FINISHED
49};
50
51/** Per query state for the response-ip module. */
52struct respip_qstate {
53 enum respip_state state;
54};
55
56struct respip_set*
57respip_set_create(void)
58{
59 struct respip_set* set = calloc(1, sizeof(*set));
60 if(!set)
61 return NULL;
62 set->region = regional_create();
63 if(!set->region) {
64 free(set);
65 return NULL;
66 }
67 addr_tree_init(&set->ip_tree);
68 lock_rw_init(&set->lock);
69 return set;
70}
71
72/** helper traverse to delete resp_addr nodes */
73static void
74resp_addr_del(rbnode_type* n, void* ATTR_UNUSED(arg))
75{
76 struct resp_addr* r = (struct resp_addr*)n->key;
77 lock_rw_destroy(&r->lock);
78#ifdef THREADS_DISABLED
79 (void)r;
80#endif
81}
82
83void
84respip_set_delete(struct respip_set* set)
85{
86 if(!set)
87 return;
88 lock_rw_destroy(&set->lock);
89 traverse_postorder(&set->ip_tree, resp_addr_del, NULL);
90 regional_destroy(set->region);
91 free(set);
92}
93
94struct rbtree_type*
95respip_set_get_tree(struct respip_set* set)
96{
97 if(!set)
98 return NULL;
99 return &set->ip_tree;
100}
101
102struct resp_addr*
103respip_sockaddr_find_or_create(struct respip_set* set, struct sockaddr_storage* addr,
104 socklen_t addrlen, int net, int create, const char* ipstr)
105{
106 struct resp_addr* node;
107 node = (struct resp_addr*)addr_tree_find(&set->ip_tree, addr, addrlen, net);
108 if(!node && create) {
109 node = regional_alloc_zero(set->region, sizeof(*node));
110 if(!node) {
111 log_err("out of memory");
112 return NULL;
113 }
114 lock_rw_init(&node->lock);
115 node->action = respip_none;
116 if(!addr_tree_insert(&set->ip_tree, &node->node, addr,
117 addrlen, net)) {
118 /* We know we didn't find it, so this should be
119 * impossible. */
120 log_warn("unexpected: duplicate address: %s", ipstr);
121 }
122 }
123 return node;
124}
125
126void
127respip_sockaddr_delete(struct respip_set* set, struct resp_addr* node)
128{
129 struct resp_addr* prev;
130 prev = (struct resp_addr*)rbtree_previous((struct rbnode_type*)node);
131 lock_rw_destroy(&node->lock);
132 rbtree_delete(&set->ip_tree, node);
133 /* no free'ing, all allocated in region */
134 if(!prev)
135 addr_tree_init_parents((rbtree_type*)set);
136 else
137 addr_tree_init_parents_node(&prev->node);
138}
139
140/** returns the node in the address tree for the specified netblock string;
141 * non-existent node will be created if 'create' is true */
142static struct resp_addr*
143respip_find_or_create(struct respip_set* set, const char* ipstr, int create)
144{
145 struct sockaddr_storage addr;
146 int net;
147 socklen_t addrlen;
148
149 if(!netblockstrtoaddr(ipstr, 0, &addr, &addrlen, &net)) {
150 log_err("cannot parse netblock: '%s'", ipstr);
151 return NULL;
152 }
153 return respip_sockaddr_find_or_create(set, &addr, addrlen, net, create,
154 ipstr);
155}
156
157static int
158respip_tag_cfg(struct respip_set* set, const char* ipstr,
159 const uint8_t* taglist, size_t taglen)
160{
161 struct resp_addr* node;
162
163 if(!(node=respip_find_or_create(set, ipstr, 1)))
164 return 0;
165 if(node->taglist) {
166 log_warn("duplicate response-address-tag for '%s', overridden.",
167 ipstr);
168 }
169 node->taglist = regional_alloc_init(set->region, taglist, taglen);
170 if(!node->taglist) {
171 log_err("out of memory");
172 return 0;
173 }
174 node->taglen = taglen;
175 return 1;
176}
177
178/** set action for the node specified by the netblock string */
179static int
180respip_action_cfg(struct respip_set* set, const char* ipstr,
181 const char* actnstr)
182{
183 struct resp_addr* node;
184 enum respip_action action;
185
186 if(!(node=respip_find_or_create(set, ipstr, 1)))
187 return 0;
188 if(node->action != respip_none) {
189 verbose(VERB_QUERY, "duplicate response-ip action for '%s', overridden.",
190 ipstr);
191 }
192 if(strcmp(actnstr, "deny") == 0)
193 action = respip_deny;
194 else if(strcmp(actnstr, "redirect") == 0)
195 action = respip_redirect;
196 else if(strcmp(actnstr, "inform") == 0)
197 action = respip_inform;
198 else if(strcmp(actnstr, "inform_deny") == 0)
199 action = respip_inform_deny;
200 else if(strcmp(actnstr, "inform_redirect") == 0)
201 action = respip_inform_redirect;
202 else if(strcmp(actnstr, "always_transparent") == 0)
203 action = respip_always_transparent;
204 else if(strcmp(actnstr, "always_refuse") == 0)
205 action = respip_always_refuse;
206 else if(strcmp(actnstr, "always_nxdomain") == 0)
207 action = respip_always_nxdomain;
208 else if(strcmp(actnstr, "always_nodata") == 0)
209 action = respip_always_nodata;
210 else if(strcmp(actnstr, "always_deny") == 0)
211 action = respip_always_deny;
212 else {
213 log_err("unknown response-ip action %s", actnstr);
214 return 0;
215 }
216 node->action = action;
217 return 1;
218}
219
220/** allocate and initialize an rrset structure; this function is based
221 * on new_local_rrset() from the localzone.c module */
222static struct ub_packed_rrset_key*
223new_rrset(struct regional* region, uint16_t rrtype, uint16_t rrclass)
224{
225 struct packed_rrset_data* pd;
226 struct ub_packed_rrset_key* rrset = regional_alloc_zero(
227 region, sizeof(*rrset));
228 if(!rrset) {
229 log_err("out of memory");
230 return NULL;
231 }
232 rrset->entry.key = rrset;
233 pd = regional_alloc_zero(region, sizeof(*pd));
234 if(!pd) {
235 log_err("out of memory");
236 return NULL;
237 }
238 pd->trust = rrset_trust_prim_noglue;
239 pd->security = sec_status_insecure;
240 rrset->entry.data = pd;
241 rrset->rk.dname = regional_alloc_zero(region, 1);
242 if(!rrset->rk.dname) {
243 log_err("out of memory");
244 return NULL;
245 }
246 rrset->rk.dname_len = 1;
247 rrset->rk.type = htons(rrtype);
248 rrset->rk.rrset_class = htons(rrclass);
249 return rrset;
250}
251
252/** enter local data as resource records into a response-ip node */
253
254int
255respip_enter_rr(struct regional* region, struct resp_addr* raddr,
256 uint16_t rrtype, uint16_t rrclass, time_t ttl, uint8_t* rdata,
257 size_t rdata_len, const char* rrstr, const char* netblockstr)
258{
259 struct packed_rrset_data* pd;
260 struct sockaddr* sa;
261 sa = (struct sockaddr*)&raddr->node.addr;
262 if (rrtype == LDNS_RR_TYPE_CNAME && raddr->data) {
263 log_err("CNAME response-ip data (%s) can not co-exist with other "
264 "response-ip data for netblock %s", rrstr, netblockstr);
265 return 0;
266 } else if (raddr->data &&
267 raddr->data->rk.type == htons(LDNS_RR_TYPE_CNAME)) {
268 log_err("response-ip data (%s) can not be added; CNAME response-ip "
269 "data already in place for netblock %s", rrstr, netblockstr);
270 return 0;
271 } else if((rrtype != LDNS_RR_TYPE_CNAME) &&
272 ((sa->sa_family == AF_INET && rrtype != LDNS_RR_TYPE_A) ||
273 (sa->sa_family == AF_INET6 && rrtype != LDNS_RR_TYPE_AAAA))) {
274 log_err("response-ip data %s record type does not correspond "
275 "to netblock %s address family", rrstr, netblockstr);
276 return 0;
277 }
278
279 if(!raddr->data) {
280 raddr->data = new_rrset(region, rrtype, rrclass);
281 if(!raddr->data)
282 return 0;
283 }
284 pd = raddr->data->entry.data;
285 return rrset_insert_rr(region, pd, rdata, rdata_len, ttl, rrstr);
286}
287
288static int
289respip_enter_rrstr(struct regional* region, struct resp_addr* raddr,
290 const char* rrstr, const char* netblock)
291{
292 uint8_t* nm;
293 uint16_t rrtype = 0, rrclass = 0;
294 time_t ttl = 0;
295 uint8_t rr[LDNS_RR_BUF_SIZE];
296 uint8_t* rdata = NULL;
297 size_t rdata_len = 0;
298 char buf[65536];
299 char bufshort[64];
300 int ret;
301 if(raddr->action != respip_redirect
302 && raddr->action != respip_inform_redirect) {
303 log_err("cannot parse response-ip-data %s: response-ip "
304 "action for %s is not redirect", rrstr, netblock);
305 return 0;
306 }
307 ret = snprintf(buf, sizeof(buf), ". %s", rrstr);
308 if(ret < 0 || ret >= (int)sizeof(buf)) {
309 strlcpy(bufshort, rrstr, sizeof(bufshort));
310 log_err("bad response-ip-data: %s...", bufshort);
311 return 0;
312 }
313 if(!rrstr_get_rr_content(buf, &nm, &rrtype, &rrclass, &ttl, rr, sizeof(rr),
314 &rdata, &rdata_len)) {
315 log_err("bad response-ip-data: %s", rrstr);
316 return 0;
317 }
318 free(nm);
319 return respip_enter_rr(region, raddr, rrtype, rrclass, ttl, rdata,
320 rdata_len, rrstr, netblock);
321}
322
323static int
324respip_data_cfg(struct respip_set* set, const char* ipstr, const char* rrstr)
325{
326 struct resp_addr* node;
327
328 node=respip_find_or_create(set, ipstr, 0);
329 if(!node || node->action == respip_none) {
330 log_err("cannot parse response-ip-data %s: "
331 "response-ip node for %s not found", rrstr, ipstr);
332 return 0;
333 }
334 return respip_enter_rrstr(set->region, node, rrstr, ipstr);
335}
336
337static int
338respip_set_apply_cfg(struct respip_set* set, char* const* tagname, int num_tags,
339 struct config_strbytelist* respip_tags,
340 struct config_str2list* respip_actions,
341 struct config_str2list* respip_data)
342{
343 struct config_strbytelist* p;
344 struct config_str2list* pa;
345 struct config_str2list* pd;
346
347 set->tagname = tagname;
348 set->num_tags = num_tags;
349
350 p = respip_tags;
351 while(p) {
352 struct config_strbytelist* np = p->next;
353
354 log_assert(p->str && p->str2);
355 if(!respip_tag_cfg(set, p->str, p->str2, p->str2len)) {
356 config_del_strbytelist(p);
357 return 0;
358 }
359 free(p->str);
360 free(p->str2);
361 free(p);
362 p = np;
363 }
364
365 pa = respip_actions;
366 while(pa) {
367 struct config_str2list* np = pa->next;
368 log_assert(pa->str && pa->str2);
369 if(!respip_action_cfg(set, pa->str, pa->str2)) {
370 config_deldblstrlist(pa);
371 return 0;
372 }
373 free(pa->str);
374 free(pa->str2);
375 free(pa);
376 pa = np;
377 }
378
379 pd = respip_data;
380 while(pd) {
381 struct config_str2list* np = pd->next;
382 log_assert(pd->str && pd->str2);
383 if(!respip_data_cfg(set, pd->str, pd->str2)) {
384 config_deldblstrlist(pd);
385 return 0;
386 }
387 free(pd->str);
388 free(pd->str2);
389 free(pd);
390 pd = np;
391 }
392 addr_tree_init_parents(&set->ip_tree);
393
394 return 1;
395}
396
397int
398respip_global_apply_cfg(struct respip_set* set, struct config_file* cfg)
399{
400 int ret = respip_set_apply_cfg(set, cfg->tagname, cfg->num_tags,
401 cfg->respip_tags, cfg->respip_actions, cfg->respip_data);
402 cfg->respip_data = NULL;
403 cfg->respip_actions = NULL;
404 cfg->respip_tags = NULL;
405 return ret;
406}
407
408/** Iterate through raw view data and apply the view-specific respip
409 * configuration; at this point we should have already seen all the views,
410 * so if any of the views that respip data refer to does not exist, that's
411 * an error. This additional iteration through view configuration data
412 * is expected to not have significant performance impact (or rather, its
413 * performance impact is not expected to be prohibitive in the configuration
414 * processing phase).
415 */
416int
417respip_views_apply_cfg(struct views* vs, struct config_file* cfg,
418 int* have_view_respip_cfg)
419{
420 struct config_view* cv;
421 struct view* v;
422 int ret;
423
424 for(cv = cfg->views; cv; cv = cv->next) {
425
426 /** if no respip config for this view then there's
427 * nothing to do; note that even though respip data must go
428 * with respip action, we're checking for both here because
429 * we want to catch the case where the respip action is missing
430 * while the data is present */
431 if(!cv->respip_actions && !cv->respip_data)
432 continue;
433
434 if(!(v = views_find_view(vs, cv->name, 1))) {
435 log_err("view '%s' unexpectedly missing", cv->name);
436 return 0;
437 }
438 if(!v->respip_set) {
439 v->respip_set = respip_set_create();
440 if(!v->respip_set) {
441 log_err("out of memory");
442 lock_rw_unlock(&v->lock);
443 return 0;
444 }
445 }
446 ret = respip_set_apply_cfg(v->respip_set, NULL, 0, NULL,
447 cv->respip_actions, cv->respip_data);
448 lock_rw_unlock(&v->lock);
449 if(!ret) {
450 log_err("Error while applying respip configuration "
451 "for view '%s'", cv->name);
452 return 0;
453 }
454 *have_view_respip_cfg = (*have_view_respip_cfg ||
455 v->respip_set->ip_tree.count);
456 cv->respip_actions = NULL;
457 cv->respip_data = NULL;
458 }
459 return 1;
460}
461
462/**
463 * make a deep copy of 'key' in 'region'.
464 * This is largely derived from packed_rrset_copy_region() and
465 * packed_rrset_ptr_fixup(), but differs in the following points:
466 *
467 * - It doesn't assume all data in 'key' are in a contiguous memory region.
468 * Although that would be the case in most cases, 'key' can be passed from
469 * a lower-level module and it might not build the rrset to meet the
470 * assumption. In fact, an rrset specified as response-ip-data or generated
471 * in local_data_find_tag_datas() breaks the assumption. So it would be
472 * safer not to naively rely on the assumption. On the other hand, this
473 * function ensures the copied rrset data are in a contiguous region so
474 * that it won't cause a disruption even if an upper layer module naively
475 * assumes the memory layout.
476 * - It doesn't copy RRSIGs (if any) in 'key'. The rrset will be used in
477 * a reply that was already faked, so it doesn't make much sense to provide
478 * partial sigs even if they are valid themselves.
479 * - It doesn't adjust TTLs as it basically has to be a verbatim copy of 'key'
480 * just allocated in 'region' (the assumption is necessary TTL adjustment
481 * has been already done in 'key').
482 *
483 * This function returns the copied rrset key on success, and NULL on memory
484 * allocation failure.
485 */
486static struct ub_packed_rrset_key*
487copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region)
488{
489 struct ub_packed_rrset_key* ck = regional_alloc(region,
490 sizeof(struct ub_packed_rrset_key));
491 struct packed_rrset_data* d;
492 struct packed_rrset_data* data = key->entry.data;
493 size_t dsize, i;
494 uint8_t* nextrdata;
495
496 /* derived from packed_rrset_copy_region(), but don't use
497 * packed_rrset_sizeof() and do exclude RRSIGs */
498 if(!ck)
499 return NULL;
500 ck->id = key->id;
501 memset(&ck->entry, 0, sizeof(ck->entry));
502 ck->entry.hash = key->entry.hash;
503 ck->entry.key = ck;
504 ck->rk = key->rk;
505 if(key->rk.dname) {
506 ck->rk.dname = regional_alloc_init(region, key->rk.dname,
507 key->rk.dname_len);
508 if(!ck->rk.dname)
509 return NULL;
510 ck->rk.dname_len = key->rk.dname_len;
511 } else {
512 ck->rk.dname = NULL;
513 ck->rk.dname_len = 0;
514 }
515
516 if((unsigned)data->count >= 0xffff00U)
517 return NULL; /* guard against integer overflow in dsize */
518 dsize = sizeof(struct packed_rrset_data) + data->count *
519 (sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t));
520 for(i=0; i<data->count; i++) {
521 if((unsigned)dsize >= 0x0fffffffU ||
522 (unsigned)data->rr_len[i] >= 0x0fffffffU)
523 return NULL; /* guard against integer overflow */
524 dsize += data->rr_len[i];
525 }
526 d = regional_alloc(region, dsize);
527 if(!d)
528 return NULL;
529 *d = *data;
530 d->rrsig_count = 0;
531 ck->entry.data = d;
532
533 /* derived from packed_rrset_ptr_fixup() with copying the data */
534 d->rr_len = (size_t*)((uint8_t*)d + sizeof(struct packed_rrset_data));
535 d->rr_data = (uint8_t**)&(d->rr_len[d->count]);
536 d->rr_ttl = (time_t*)&(d->rr_data[d->count]);
537 nextrdata = (uint8_t*)&(d->rr_ttl[d->count]);
538 for(i=0; i<d->count; i++) {
539 d->rr_len[i] = data->rr_len[i];
540 d->rr_ttl[i] = data->rr_ttl[i];
541 d->rr_data[i] = nextrdata;
542 memcpy(d->rr_data[i], data->rr_data[i], data->rr_len[i]);
543 nextrdata += d->rr_len[i];
544 }
545
546 return ck;
547}
548
549int
550respip_init(struct module_env* env, int id)
551{
552 (void)env;
553 (void)id;
554 return 1;
555}
556
557void
558respip_deinit(struct module_env* env, int id)
559{
560 (void)env;
561 (void)id;
562}
563
564/** Convert a packed AAAA or A RRset to sockaddr. */
565static int
566rdata2sockaddr(const struct packed_rrset_data* rd, uint16_t rtype, size_t i,
567 struct sockaddr_storage* ss, socklen_t* addrlenp)
568{
569 /* unbound can accept and cache odd-length AAAA/A records, so we have
570 * to validate the length. */
571 if(rtype == LDNS_RR_TYPE_A && rd->rr_len[i] == 6) {
572 struct sockaddr_in* sa4 = (struct sockaddr_in*)ss;
573
574 memset(sa4, 0, sizeof(*sa4));
575 sa4->sin_family = AF_INET;
576 memcpy(&sa4->sin_addr, rd->rr_data[i] + 2,
577 sizeof(sa4->sin_addr));
578 *addrlenp = sizeof(*sa4);
579 return 1;
580 } else if(rtype == LDNS_RR_TYPE_AAAA && rd->rr_len[i] == 18) {
581 struct sockaddr_in6* sa6 = (struct sockaddr_in6*)ss;
582
583 memset(sa6, 0, sizeof(*sa6));
584 sa6->sin6_family = AF_INET6;
585 memcpy(&sa6->sin6_addr, rd->rr_data[i] + 2,
586 sizeof(sa6->sin6_addr));
587 *addrlenp = sizeof(*sa6);
588 return 1;
589 }
590 return 0;
591}
592
593/**
594 * Search the given 'iptree' for response address information that matches
595 * any of the IP addresses in an AAAA or A in the answer section of the
596 * response (stored in 'rep'). If found, a pointer to the matched resp_addr
597 * structure will be returned, and '*rrset_id' is set to the index in
598 * rep->rrsets for the RRset that contains the matching IP address record
599 * (the index is normally 0, but can be larger than that if this is a CNAME
600 * chain or type-ANY response).
601 * Returns resp_addr holding read lock.
602 */
603static struct resp_addr*
604respip_addr_lookup(const struct reply_info *rep, struct respip_set* rs,
605 size_t* rrset_id)
606{
607 size_t i;
608 struct resp_addr* ra;
609 struct sockaddr_storage ss;
610 socklen_t addrlen;
611
612 lock_rw_rdlock(&rs->lock);
613 for(i=0; i<rep->an_numrrsets; i++) {
614 size_t j;
615 const struct packed_rrset_data* rd;
616 uint16_t rtype = ntohs(rep->rrsets[i]->rk.type);
617
618 if(rtype != LDNS_RR_TYPE_A && rtype != LDNS_RR_TYPE_AAAA)
619 continue;
620 rd = rep->rrsets[i]->entry.data;
621 for(j = 0; j < rd->count; j++) {
622 if(!rdata2sockaddr(rd, rtype, j, &ss, &addrlen))
623 continue;
624 ra = (struct resp_addr*)addr_tree_lookup(&rs->ip_tree,
625 &ss, addrlen);
626 if(ra) {
627 *rrset_id = i;
628 lock_rw_rdlock(&ra->lock);
629 lock_rw_unlock(&rs->lock);
630 return ra;
631 }
632 }
633 }
634 lock_rw_unlock(&rs->lock);
635 return NULL;
636}
637
638/*
639 * Create a new reply_info based on 'rep'. The new info is based on
640 * the passed 'rep', but ignores any rrsets except for the first 'an_numrrsets'
641 * RRsets in the answer section. These answer rrsets are copied to the
642 * new info, up to 'copy_rrsets' rrsets (which must not be larger than
643 * 'an_numrrsets'). If an_numrrsets > copy_rrsets, the remaining rrsets array
644 * entries will be kept empty so the caller can fill them later. When rrsets
645 * are copied, they are shallow copied. The caller must ensure that the
646 * copied rrsets are valid throughout its lifetime and must provide appropriate
647 * mutex if it can be shared by multiple threads.
648 */
649static struct reply_info *
650make_new_reply_info(const struct reply_info* rep, struct regional* region,
651 size_t an_numrrsets, size_t copy_rrsets)
652{
653 struct reply_info* new_rep;
654 size_t i;
655
656 /* create a base struct. we specify 'insecure' security status as
657 * the modified response won't be DNSSEC-valid. In our faked response
658 * the authority and additional sections will be empty (except possible
659 * EDNS0 OPT RR in the additional section appended on sending it out),
660 * so the total number of RRsets is an_numrrsets. */
661 new_rep = construct_reply_info_base(region, rep->flags,
662 rep->qdcount, rep->ttl, rep->prefetch_ttl,
663 rep->serve_expired_ttl, an_numrrsets, 0, 0, an_numrrsets,
664 sec_status_insecure);
665 if(!new_rep)
666 return NULL;
667 if(!reply_info_alloc_rrset_keys(new_rep, NULL, region))
668 return NULL;
669 for(i=0; i<copy_rrsets; i++)
670 new_rep->rrsets[i] = rep->rrsets[i];
671
672 return new_rep;
673}
674
675/**
676 * See if response-ip or tag data should override the original answer rrset
677 * (which is rep->rrsets[rrset_id]) and if so override it.
678 * This is (mostly) equivalent to localzone.c:local_data_answer() but for
679 * response-ip actions.
680 * Note that this function distinguishes error conditions from "success but
681 * not overridden". This is because we want to avoid accidentally applying
682 * the "no data" action in case of error.
683 * @param action: action to apply
684 * @param data: RRset to use for override
685 * @param qtype: original query type
686 * @param rep: original reply message
687 * @param rrset_id: the rrset ID in 'rep' to which the action should apply
688 * @param new_repp: see respip_rewrite_reply
689 * @param tag: if >= 0 the tag ID used to determine the action and data
690 * @param tag_datas: data corresponding to 'tag'.
691 * @param tag_datas_size: size of 'tag_datas'
692 * @param tagname: array of tag names, used for logging
693 * @param num_tags: size of 'tagname', used for logging
694 * @param redirect_rrsetp: ptr to redirect record
695 * @param region: region for building new reply
696 * @return 1 if overridden, 0 if not overridden, -1 on error.
697 */
698static int
699respip_data_answer(enum respip_action action,
700 struct ub_packed_rrset_key* data,
701 uint16_t qtype, const struct reply_info* rep,
702 size_t rrset_id, struct reply_info** new_repp, int tag,
703 struct config_strlist** tag_datas, size_t tag_datas_size,
704 char* const* tagname, int num_tags,
705 struct ub_packed_rrset_key** redirect_rrsetp, struct regional* region)
706{
707 struct ub_packed_rrset_key* rp = data;
708 struct reply_info* new_rep;
709 *redirect_rrsetp = NULL;
710
711 if(action == respip_redirect && tag != -1 &&
712 (size_t)tag<tag_datas_size && tag_datas[tag]) {
713 struct query_info dataqinfo;
714 struct ub_packed_rrset_key r;
715
716 /* Extract parameters of the original answer rrset that can be
717 * rewritten below, in the form of query_info. Note that these
718 * can be different from the info of the original query if the
719 * rrset is a CNAME target.*/
720 memset(&dataqinfo, 0, sizeof(dataqinfo));
721 dataqinfo.qname = rep->rrsets[rrset_id]->rk.dname;
722 dataqinfo.qname_len = rep->rrsets[rrset_id]->rk.dname_len;
723 dataqinfo.qtype = ntohs(rep->rrsets[rrset_id]->rk.type);
724 dataqinfo.qclass = ntohs(rep->rrsets[rrset_id]->rk.rrset_class);
725
726 memset(&r, 0, sizeof(r));
727 if(local_data_find_tag_datas(&dataqinfo, tag_datas[tag], &r,
728 region)) {
729 verbose(VERB_ALGO,
730 "response-ip redirect with tag data [%d] %s",
731 tag, (tag<num_tags?tagname[tag]:"null"));
732 /* use copy_rrset() to 'normalize' memory layout */
733 rp = copy_rrset(&r, region);
734 if(!rp)
735 return -1;
736 }
737 }
738 if(!rp)
739 return 0;
740
741 /* If we are using response-ip-data, we need to make a copy of rrset
742 * to replace the rrset's dname. Note that, unlike local data, we
743 * rename the dname for other actions than redirect. This is because
744 * response-ip-data isn't associated to any specific name. */
745 if(rp == data) {
746 rp = copy_rrset(rp, region);
747 if(!rp)
748 return -1;
749 rp->rk.dname = rep->rrsets[rrset_id]->rk.dname;
750 rp->rk.dname_len = rep->rrsets[rrset_id]->rk.dname_len;
751 }
752
753 /* Build a new reply with redirect rrset. We keep any preceding CNAMEs
754 * and replace the address rrset that triggers the action. If it's
755 * type ANY query, however, no other answer records should be kept
756 * (note that it can't be a CNAME chain in this case due to
757 * sanitizing). */
758 if(qtype == LDNS_RR_TYPE_ANY)
759 rrset_id = 0;
760 new_rep = make_new_reply_info(rep, region, rrset_id + 1, rrset_id);
761 if(!new_rep)
762 return -1;
763 rp->rk.flags |= PACKED_RRSET_FIXEDTTL; /* avoid adjusting TTL */
764 new_rep->rrsets[rrset_id] = rp;
765
766 *redirect_rrsetp = rp;
767 *new_repp = new_rep;
768 return 1;
769}
770
771/**
772 * apply response ip action in case where no action data is provided.
773 * this is similar to localzone.c:lz_zone_answer() but simplified due to
774 * the characteristics of response ip:
775 * - 'deny' variants will be handled at the caller side
776 * - no specific processing for 'transparent' variants: unlike local zones,
777 * there is no such a case of 'no data but name existing'. so all variants
778 * just mean 'transparent if no data'.
779 * @param qtype: query type
780 * @param action: found action
781 * @param rep:
782 * @param new_repp
783 * @param rrset_id
784 * @param region: region for building new reply
785 * @return 1 on success, 0 on error.
786 */
787static int
788respip_nodata_answer(uint16_t qtype, enum respip_action action,
789 const struct reply_info *rep, size_t rrset_id,
790 struct reply_info** new_repp, struct regional* region)
791{
792 struct reply_info* new_rep;
793
794 if(action == respip_refuse || action == respip_always_refuse) {
795 new_rep = make_new_reply_info(rep, region, 0, 0);
796 if(!new_rep)
797 return 0;
798 FLAGS_SET_RCODE(new_rep->flags, LDNS_RCODE_REFUSED);
799 *new_repp = new_rep;
800 return 1;
801 } else if(action == respip_static || action == respip_redirect ||
802 action == respip_always_nxdomain ||
803 action == respip_always_nodata ||
804 action == respip_inform_redirect) {
805 /* Since we don't know about other types of the owner name,
806 * we generally return NOERROR/NODATA unless an NXDOMAIN action
807 * is explicitly specified. */
808 int rcode = (action == respip_always_nxdomain)?
809 LDNS_RCODE_NXDOMAIN:LDNS_RCODE_NOERROR;
810
811 /* We should empty the answer section except for any preceding
812 * CNAMEs (in that case rrset_id > 0). Type-ANY case is
813 * special as noted in respip_data_answer(). */
814 if(qtype == LDNS_RR_TYPE_ANY)
815 rrset_id = 0;
816 new_rep = make_new_reply_info(rep, region, rrset_id, rrset_id);
817 if(!new_rep)
818 return 0;
819 FLAGS_SET_RCODE(new_rep->flags, rcode);
820 *new_repp = new_rep;
821 return 1;
822 }
823
824 return 1;
825}
826
827/** Populate action info structure with the results of response-ip action
828 * processing, iff as the result of response-ip processing we are actually
829 * taking some action. Only action is set if action_only is true.
830 * Returns true on success, false on failure.
831 */
832static int
833populate_action_info(struct respip_action_info* actinfo,
834 enum respip_action action, const struct resp_addr* raddr,
835 const struct ub_packed_rrset_key* ATTR_UNUSED(rrset),
836 int ATTR_UNUSED(tag), const struct respip_set* ATTR_UNUSED(ipset),
837 int ATTR_UNUSED(action_only), struct regional* region, int rpz_used,
838 int rpz_log, char* log_name, int rpz_cname_override)
839{
840 if(action == respip_none || !raddr)
841 return 1;
842 actinfo->action = action;
843 actinfo->rpz_used = rpz_used;
844 actinfo->rpz_log = rpz_log;
845 actinfo->log_name = log_name;
846 actinfo->rpz_cname_override = rpz_cname_override;
847
848 /* for inform variants, make a copy of the matched address block for
849 * later logging. We make a copy to proactively avoid disruption if
850 * and when we allow a dynamic update to the respip tree. */
851 if(action == respip_inform || action == respip_inform_deny ||
852 rpz_used) {
853 struct respip_addr_info* a =
854 regional_alloc_zero(region, sizeof(*a));
855 if(!a) {
856 log_err("out of memory");
857 return 0;
858 }
859 a->addr = raddr->node.addr;
860 a->addrlen = raddr->node.addrlen;
861 a->net = raddr->node.net;
862 actinfo->addrinfo = a;
863 }
864
865 return 1;
866}
867
868static int
869respip_use_rpz(struct resp_addr* raddr, struct rpz* r,
870 enum respip_action* action,
871 struct ub_packed_rrset_key** data, int* rpz_log, char** log_name,
872 int* rpz_cname_override, struct regional* region, int* is_rpz)
873{
874 if(r->action_override == RPZ_DISABLED_ACTION) {
875 *is_rpz = 0;
876 return 1;
877 }
878 else if(r->action_override == RPZ_NO_OVERRIDE_ACTION)
879 *action = raddr->action;
880 else
881 *action = rpz_action_to_respip_action(r->action_override);
882 if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION &&
883 r->cname_override) {
884 *data = r->cname_override;
885 *rpz_cname_override = 1;
886 }
887 *rpz_log = r->log;
888 if(r->log_name)
889 if(!(*log_name = regional_strdup(region, r->log_name)))
890 return 0;
891 *is_rpz = 1;
892 return 1;
893}
894
895int
896respip_rewrite_reply(const struct query_info* qinfo,
897 const struct respip_client_info* cinfo, const struct reply_info* rep,
898 struct reply_info** new_repp, struct respip_action_info* actinfo,
899 struct ub_packed_rrset_key** alias_rrset, int search_only,
900 struct regional* region, struct auth_zones* az)
901{
902 const uint8_t* ctaglist;
903 size_t ctaglen;
904 const uint8_t* tag_actions;
905 size_t tag_actions_size;
906 struct config_strlist** tag_datas;
907 size_t tag_datas_size;
908 struct view* view = NULL;
909 struct respip_set* ipset = NULL;
910 size_t rrset_id = 0;
911 enum respip_action action = respip_none;
912 int tag = -1;
913 struct resp_addr* raddr = NULL;
914 int ret = 1;
915 struct ub_packed_rrset_key* redirect_rrset = NULL;
916 struct rpz* r;
|
918 struct ub_packed_rrset_key* data = NULL;
919 int rpz_used = 0;
920 int rpz_log = 0;
921 int rpz_cname_override = 0;
922 char* log_name = NULL;
923
924 if(!cinfo)
925 goto done;
926 ctaglist = cinfo->taglist;
927 ctaglen = cinfo->taglen;
928 tag_actions = cinfo->tag_actions;
929 tag_actions_size = cinfo->tag_actions_size;
930 tag_datas = cinfo->tag_datas;
931 tag_datas_size = cinfo->tag_datas_size;
932 view = cinfo->view;
933 ipset = cinfo->respip_set;
934
935 log_assert(ipset);
936
937 /** Try to use response-ip config from the view first; use
938 * global response-ip config if we don't have the view or we don't
939 * have the matching per-view config (and the view allows the use
940 * of global data in this case).
941 * Note that we lock the view even if we only use view members that
942 * currently don't change after creation. This is for safety for
943 * future possible changes as the view documentation seems to expect
944 * any of its member can change in the view's lifetime.
945 * Note also that we assume 'view' is valid in this function, which
946 * should be safe (see unbound bug #1191) */
947 if(view) {
948 lock_rw_rdlock(&view->lock);
949 if(view->respip_set) {
950 if((raddr = respip_addr_lookup(rep,
951 view->respip_set, &rrset_id))) {
952 /** for per-view respip directives the action
953 * can only be direct (i.e. not tag-based) */
954 action = raddr->action;
955 }
956 }
957 if(!raddr && !view->isfirst)
958 goto done;
959 if(!raddr && view->isfirst) {
960 lock_rw_unlock(&view->lock);
961 view = NULL;
962 }
963 }
964 if(!raddr && (raddr = respip_addr_lookup(rep, ipset,
965 &rrset_id))) {
966 action = (enum respip_action)local_data_find_tag_action(
967 raddr->taglist, raddr->taglen, ctaglist, ctaglen,
968 tag_actions, tag_actions_size,
969 (enum localzone_type)raddr->action, &tag,
970 ipset->tagname, ipset->num_tags);
971 }
972 lock_rw_rdlock(&az->rpz_lock);
973 for(a = az->rpz_first; a && !raddr; a = a->rpz_az_next) {
974 lock_rw_rdlock(&a->lock);
975 r = a->rpz;
976 if(!r->taglist || taglist_intersect(r->taglist,
977 r->taglistlen, ctaglist, ctaglen)) {
978 if((raddr = respip_addr_lookup(rep,
979 r->respip_set, &rrset_id))) {
980 if(!respip_use_rpz(raddr, r, &action, &data,
981 &rpz_log, &log_name, &rpz_cname_override,
982 region, &rpz_used)) {
983 log_err("out of memory");
984 lock_rw_unlock(&raddr->lock);
985 lock_rw_unlock(&a->lock);
986 lock_rw_unlock(&az->rpz_lock);
987 return 0;
988 }
989 if(rpz_used) {
990 /* break to make sure 'a' stays pointed
991 * to used auth_zone, and keeps lock */
992 break;
993 }
994 lock_rw_unlock(&raddr->lock);
995 raddr = NULL;
996 actinfo->rpz_disabled++;
997 }
998 }
999 lock_rw_unlock(&a->lock);
1000 }
1001 lock_rw_unlock(&az->rpz_lock);
1002 if(raddr && !search_only) {
1003 int result = 0;
1004
1005 /* first, see if we have response-ip or tag action for the
1006 * action except for 'always' variants. */
1007 if(action != respip_always_refuse
1008 && action != respip_always_transparent
1009 && action != respip_always_nxdomain
1010 && action != respip_always_nodata
1011 && action != respip_always_deny
1012 && (result = respip_data_answer(action,
1013 (data) ? data : raddr->data, qinfo->qtype, rep,
1014 rrset_id, new_repp, tag, tag_datas, tag_datas_size,
1015 ipset->tagname, ipset->num_tags, &redirect_rrset,
1016 region)) < 0) {
1017 ret = 0;
1018 goto done;
1019 }
1020
1021 /* if no action data applied, take action specific to the
1022 * action without data. */
1023 if(!result && !respip_nodata_answer(qinfo->qtype, action, rep,
1024 rrset_id, new_repp, region)) {
1025 ret = 0;
1026 goto done;
1027 }
1028 }
1029 done:
1030 if(view) {
1031 lock_rw_unlock(&view->lock);
1032 }
1033 if(ret) {
1034 /* If we're redirecting the original answer to a
1035 * CNAME, record the CNAME rrset so the caller can take
1036 * the appropriate action. Note that we don't check the
1037 * action type; it should normally be 'redirect', but it
1038 * can be of other type when a data-dependent tag action
1039 * uses redirect response-ip data.
1040 */
1041 if(redirect_rrset &&
1042 redirect_rrset->rk.type == ntohs(LDNS_RR_TYPE_CNAME) &&
1043 qinfo->qtype != LDNS_RR_TYPE_ANY)
1044 *alias_rrset = redirect_rrset;
1045 /* on success, populate respip result structure */
1046 ret = populate_action_info(actinfo, action, raddr,
1047 redirect_rrset, tag, ipset, search_only, region,
1048 rpz_used, rpz_log, log_name, rpz_cname_override);
1049 }
1050 if(raddr) {
1051 lock_rw_unlock(&raddr->lock);
1052 }
1053 if(rpz_used) {
1054 lock_rw_unlock(&a->lock);
1055 }
1056 return ret;
1057}
1058
1059static int
1060generate_cname_request(struct module_qstate* qstate,
1061 struct ub_packed_rrset_key* alias_rrset)
1062{
1063 struct module_qstate* subq = NULL;
1064 struct query_info subqi;
1065
1066 memset(&subqi, 0, sizeof(subqi));
1067 get_cname_target(alias_rrset, &subqi.qname, &subqi.qname_len);
1068 if(!subqi.qname)
1069 return 0; /* unexpected: not a valid CNAME RDATA */
1070 subqi.qtype = qstate->qinfo.qtype;
1071 subqi.qclass = qstate->qinfo.qclass;
1072 fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
1073 return (*qstate->env->attach_sub)(qstate, &subqi, BIT_RD, 0, 0, &subq);
1074}
1075
1076void
1077respip_operate(struct module_qstate* qstate, enum module_ev event, int id,
1078 struct outbound_entry* outbound)
1079{
1080 struct respip_qstate* rq = (struct respip_qstate*)qstate->minfo[id];
1081
1082 log_query_info(VERB_QUERY, "respip operate: query", &qstate->qinfo);
1083 (void)outbound;
1084
1085 if(event == module_event_new || event == module_event_pass) {
1086 if(!rq) {
1087 rq = regional_alloc_zero(qstate->region, sizeof(*rq));
1088 if(!rq)
1089 goto servfail;
1090 rq->state = RESPIP_INIT;
1091 qstate->minfo[id] = rq;
1092 }
1093 if(rq->state == RESPIP_SUBQUERY_FINISHED) {
1094 qstate->ext_state[id] = module_finished;
1095 return;
1096 }
1097 verbose(VERB_ALGO, "respip: pass to next module");
1098 qstate->ext_state[id] = module_wait_module;
1099 } else if(event == module_event_moddone) {
1100 /* If the reply may be subject to response-ip rewriting
1101 * according to the query type, check the actions. If a
1102 * rewrite is necessary, we'll replace the reply in qstate
1103 * with the new one. */
1104 enum module_ext_state next_state = module_finished;
1105
1106 if((qstate->qinfo.qtype == LDNS_RR_TYPE_A ||
1107 qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA ||
1108 qstate->qinfo.qtype == LDNS_RR_TYPE_ANY) &&
1109 qstate->return_msg && qstate->return_msg->rep) {
1110 struct reply_info* new_rep = qstate->return_msg->rep;
1111 struct ub_packed_rrset_key* alias_rrset = NULL;
| 918 struct ub_packed_rrset_key* data = NULL;
919 int rpz_used = 0;
920 int rpz_log = 0;
921 int rpz_cname_override = 0;
922 char* log_name = NULL;
923
924 if(!cinfo)
925 goto done;
926 ctaglist = cinfo->taglist;
927 ctaglen = cinfo->taglen;
928 tag_actions = cinfo->tag_actions;
929 tag_actions_size = cinfo->tag_actions_size;
930 tag_datas = cinfo->tag_datas;
931 tag_datas_size = cinfo->tag_datas_size;
932 view = cinfo->view;
933 ipset = cinfo->respip_set;
934
935 log_assert(ipset);
936
937 /** Try to use response-ip config from the view first; use
938 * global response-ip config if we don't have the view or we don't
939 * have the matching per-view config (and the view allows the use
940 * of global data in this case).
941 * Note that we lock the view even if we only use view members that
942 * currently don't change after creation. This is for safety for
943 * future possible changes as the view documentation seems to expect
944 * any of its member can change in the view's lifetime.
945 * Note also that we assume 'view' is valid in this function, which
946 * should be safe (see unbound bug #1191) */
947 if(view) {
948 lock_rw_rdlock(&view->lock);
949 if(view->respip_set) {
950 if((raddr = respip_addr_lookup(rep,
951 view->respip_set, &rrset_id))) {
952 /** for per-view respip directives the action
953 * can only be direct (i.e. not tag-based) */
954 action = raddr->action;
955 }
956 }
957 if(!raddr && !view->isfirst)
958 goto done;
959 if(!raddr && view->isfirst) {
960 lock_rw_unlock(&view->lock);
961 view = NULL;
962 }
963 }
964 if(!raddr && (raddr = respip_addr_lookup(rep, ipset,
965 &rrset_id))) {
966 action = (enum respip_action)local_data_find_tag_action(
967 raddr->taglist, raddr->taglen, ctaglist, ctaglen,
968 tag_actions, tag_actions_size,
969 (enum localzone_type)raddr->action, &tag,
970 ipset->tagname, ipset->num_tags);
971 }
972 lock_rw_rdlock(&az->rpz_lock);
973 for(a = az->rpz_first; a && !raddr; a = a->rpz_az_next) {
974 lock_rw_rdlock(&a->lock);
975 r = a->rpz;
976 if(!r->taglist || taglist_intersect(r->taglist,
977 r->taglistlen, ctaglist, ctaglen)) {
978 if((raddr = respip_addr_lookup(rep,
979 r->respip_set, &rrset_id))) {
980 if(!respip_use_rpz(raddr, r, &action, &data,
981 &rpz_log, &log_name, &rpz_cname_override,
982 region, &rpz_used)) {
983 log_err("out of memory");
984 lock_rw_unlock(&raddr->lock);
985 lock_rw_unlock(&a->lock);
986 lock_rw_unlock(&az->rpz_lock);
987 return 0;
988 }
989 if(rpz_used) {
990 /* break to make sure 'a' stays pointed
991 * to used auth_zone, and keeps lock */
992 break;
993 }
994 lock_rw_unlock(&raddr->lock);
995 raddr = NULL;
996 actinfo->rpz_disabled++;
997 }
998 }
999 lock_rw_unlock(&a->lock);
1000 }
1001 lock_rw_unlock(&az->rpz_lock);
1002 if(raddr && !search_only) {
1003 int result = 0;
1004
1005 /* first, see if we have response-ip or tag action for the
1006 * action except for 'always' variants. */
1007 if(action != respip_always_refuse
1008 && action != respip_always_transparent
1009 && action != respip_always_nxdomain
1010 && action != respip_always_nodata
1011 && action != respip_always_deny
1012 && (result = respip_data_answer(action,
1013 (data) ? data : raddr->data, qinfo->qtype, rep,
1014 rrset_id, new_repp, tag, tag_datas, tag_datas_size,
1015 ipset->tagname, ipset->num_tags, &redirect_rrset,
1016 region)) < 0) {
1017 ret = 0;
1018 goto done;
1019 }
1020
1021 /* if no action data applied, take action specific to the
1022 * action without data. */
1023 if(!result && !respip_nodata_answer(qinfo->qtype, action, rep,
1024 rrset_id, new_repp, region)) {
1025 ret = 0;
1026 goto done;
1027 }
1028 }
1029 done:
1030 if(view) {
1031 lock_rw_unlock(&view->lock);
1032 }
1033 if(ret) {
1034 /* If we're redirecting the original answer to a
1035 * CNAME, record the CNAME rrset so the caller can take
1036 * the appropriate action. Note that we don't check the
1037 * action type; it should normally be 'redirect', but it
1038 * can be of other type when a data-dependent tag action
1039 * uses redirect response-ip data.
1040 */
1041 if(redirect_rrset &&
1042 redirect_rrset->rk.type == ntohs(LDNS_RR_TYPE_CNAME) &&
1043 qinfo->qtype != LDNS_RR_TYPE_ANY)
1044 *alias_rrset = redirect_rrset;
1045 /* on success, populate respip result structure */
1046 ret = populate_action_info(actinfo, action, raddr,
1047 redirect_rrset, tag, ipset, search_only, region,
1048 rpz_used, rpz_log, log_name, rpz_cname_override);
1049 }
1050 if(raddr) {
1051 lock_rw_unlock(&raddr->lock);
1052 }
1053 if(rpz_used) {
1054 lock_rw_unlock(&a->lock);
1055 }
1056 return ret;
1057}
1058
1059static int
1060generate_cname_request(struct module_qstate* qstate,
1061 struct ub_packed_rrset_key* alias_rrset)
1062{
1063 struct module_qstate* subq = NULL;
1064 struct query_info subqi;
1065
1066 memset(&subqi, 0, sizeof(subqi));
1067 get_cname_target(alias_rrset, &subqi.qname, &subqi.qname_len);
1068 if(!subqi.qname)
1069 return 0; /* unexpected: not a valid CNAME RDATA */
1070 subqi.qtype = qstate->qinfo.qtype;
1071 subqi.qclass = qstate->qinfo.qclass;
1072 fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
1073 return (*qstate->env->attach_sub)(qstate, &subqi, BIT_RD, 0, 0, &subq);
1074}
1075
1076void
1077respip_operate(struct module_qstate* qstate, enum module_ev event, int id,
1078 struct outbound_entry* outbound)
1079{
1080 struct respip_qstate* rq = (struct respip_qstate*)qstate->minfo[id];
1081
1082 log_query_info(VERB_QUERY, "respip operate: query", &qstate->qinfo);
1083 (void)outbound;
1084
1085 if(event == module_event_new || event == module_event_pass) {
1086 if(!rq) {
1087 rq = regional_alloc_zero(qstate->region, sizeof(*rq));
1088 if(!rq)
1089 goto servfail;
1090 rq->state = RESPIP_INIT;
1091 qstate->minfo[id] = rq;
1092 }
1093 if(rq->state == RESPIP_SUBQUERY_FINISHED) {
1094 qstate->ext_state[id] = module_finished;
1095 return;
1096 }
1097 verbose(VERB_ALGO, "respip: pass to next module");
1098 qstate->ext_state[id] = module_wait_module;
1099 } else if(event == module_event_moddone) {
1100 /* If the reply may be subject to response-ip rewriting
1101 * according to the query type, check the actions. If a
1102 * rewrite is necessary, we'll replace the reply in qstate
1103 * with the new one. */
1104 enum module_ext_state next_state = module_finished;
1105
1106 if((qstate->qinfo.qtype == LDNS_RR_TYPE_A ||
1107 qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA ||
1108 qstate->qinfo.qtype == LDNS_RR_TYPE_ANY) &&
1109 qstate->return_msg && qstate->return_msg->rep) {
1110 struct reply_info* new_rep = qstate->return_msg->rep;
1111 struct ub_packed_rrset_key* alias_rrset = NULL;
|
1174 actinfo.action = respip_none;
1175
1176 /* If the query for the CNAME target would result in an unusual rcode,
1177 * we generally translate it as a failure for the base query
1178 * (which would then be translated into SERVFAIL). The only exception
1179 * is NXDOMAIN and YXDOMAIN, which are passed to the end client(s).
1180 * The YXDOMAIN case would be rare but still possible (when
1181 * DNSSEC-validated DNAME has been cached but synthesizing CNAME
1182 * can't be generated due to length limitation) */
1183 tgt_rcode = FLAGS_GET_RCODE(tgt_rep->flags);
1184 if((tgt_rcode != LDNS_RCODE_NOERROR &&
1185 tgt_rcode != LDNS_RCODE_NXDOMAIN &&
1186 tgt_rcode != LDNS_RCODE_YXDOMAIN) ||
1187 (must_validate && tgt_rep->security <= sec_status_bogus)) {
1188 return 0;
1189 }
1190
1191 /* see if the target reply would be subject to a response-ip action. */
1192 if(!respip_rewrite_reply(qinfo, cinfo, tgt_rep, &tmp_rep, &actinfo,
1193 &alias_rrset, 1, region, az))
1194 return 0;
1195 if(actinfo.action != respip_none) {
1196 log_info("CNAME target of redirect response-ip action would "
1197 "be subject to response-ip action, too; stripped");
1198 *new_repp = base_rep;
1199 return 1;
1200 }
1201
1202 /* Append target reply to the base. Since we cannot assume
1203 * tgt_rep->rrsets is valid throughout the lifetime of new_rep
1204 * or it can be safely shared by multiple threads, we need to make a
1205 * deep copy. */
1206 new_rep = make_new_reply_info(base_rep, region,
1207 base_rep->an_numrrsets + tgt_rep->an_numrrsets,
1208 base_rep->an_numrrsets);
1209 if(!new_rep)
1210 return 0;
1211 for(i=0,j=base_rep->an_numrrsets; i<tgt_rep->an_numrrsets; i++,j++) {
1212 new_rep->rrsets[j] = copy_rrset(tgt_rep->rrsets[i], region);
1213 if(!new_rep->rrsets[j])
1214 return 0;
1215 }
1216
1217 FLAGS_SET_RCODE(new_rep->flags, tgt_rcode);
1218 *new_repp = new_rep;
1219 return 1;
1220}
1221
1222void
1223respip_inform_super(struct module_qstate* qstate, int id,
1224 struct module_qstate* super)
1225{
1226 struct respip_qstate* rq = (struct respip_qstate*)super->minfo[id];
1227 struct reply_info* new_rep = NULL;
1228
1229 rq->state = RESPIP_SUBQUERY_FINISHED;
1230
1231 /* respip subquery should have always been created with a valid reply
1232 * in super. */
1233 log_assert(super->return_msg && super->return_msg->rep);
1234
1235 /* return_msg can be NULL when, e.g., the sub query resulted in
1236 * SERVFAIL, in which case we regard it as a failure of the original
1237 * query. Other checks are probably redundant, but we check them
1238 * for safety. */
1239 if(!qstate->return_msg || !qstate->return_msg->rep ||
1240 qstate->return_rcode != LDNS_RCODE_NOERROR)
1241 goto fail;
1242
1243 if(!respip_merge_cname(super->return_msg->rep, &qstate->qinfo,
1244 qstate->return_msg->rep, super->client_info,
1245 super->env->need_to_validate, &new_rep, super->region,
1246 qstate->env->auth_zones))
1247 goto fail;
1248 super->return_msg->rep = new_rep;
1249 return;
1250
1251 fail:
1252 super->return_rcode = LDNS_RCODE_SERVFAIL;
1253 super->return_msg = NULL;
1254 return;
1255}
1256
1257void
1258respip_clear(struct module_qstate* qstate, int id)
1259{
1260 qstate->minfo[id] = NULL;
1261}
1262
1263size_t
1264respip_get_mem(struct module_env* env, int id)
1265{
1266 (void)env;
1267 (void)id;
1268 return 0;
1269}
1270
1271/**
1272 * The response-ip function block
1273 */
1274static struct module_func_block respip_block = {
1275 "respip",
1276 &respip_init, &respip_deinit, &respip_operate, &respip_inform_super,
1277 &respip_clear, &respip_get_mem
1278};
1279
1280struct module_func_block*
1281respip_get_funcblock(void)
1282{
1283 return &respip_block;
1284}
1285
1286enum respip_action
1287resp_addr_get_action(const struct resp_addr* addr)
1288{
1289 return addr ? addr->action : respip_none;
1290}
1291
1292struct ub_packed_rrset_key*
1293resp_addr_get_rrset(struct resp_addr* addr)
1294{
1295 return addr ? addr->data : NULL;
1296}
1297
1298int
1299respip_set_is_empty(const struct respip_set* set)
1300{
1301 return set ? set->ip_tree.count == 0 : 1;
1302}
1303
1304void
1305respip_inform_print(struct respip_action_info* respip_actinfo, uint8_t* qname,
1306 uint16_t qtype, uint16_t qclass, struct local_rrset* local_alias,
1307 struct comm_reply* repinfo)
1308{
1309 char srcip[128], respip[128], txt[512];
1310 unsigned port;
1311 struct respip_addr_info* respip_addr = respip_actinfo->addrinfo;
1312 size_t txtlen = 0;
1313 const char* actionstr = NULL;
1314
1315 if(local_alias)
1316 qname = local_alias->rrset->rk.dname;
1317 port = (unsigned)((repinfo->addr.ss_family == AF_INET) ?
1318 ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port) :
1319 ntohs(((struct sockaddr_in6*)&repinfo->addr)->sin6_port));
1320 addr_to_str(&repinfo->addr, repinfo->addrlen, srcip, sizeof(srcip));
1321 addr_to_str(&respip_addr->addr, respip_addr->addrlen,
1322 respip, sizeof(respip));
1323 if(respip_actinfo->rpz_log) {
1324 txtlen += snprintf(txt+txtlen, sizeof(txt)-txtlen, "%s",
1325 "RPZ applied ");
1326 if(respip_actinfo->rpz_cname_override)
1327 actionstr = rpz_action_to_string(
1328 RPZ_CNAME_OVERRIDE_ACTION);
1329 else
1330 actionstr = rpz_action_to_string(
1331 respip_action_to_rpz_action(
1332 respip_actinfo->action));
1333 }
1334 if(respip_actinfo->log_name) {
1335 txtlen += snprintf(txt+txtlen, sizeof(txt)-txtlen,
1336 "[%s] ", respip_actinfo->log_name);
1337 }
1338 snprintf(txt+txtlen, sizeof(txt)-txtlen,
1339 "%s/%d %s %s@%u", respip, respip_addr->net,
1340 (actionstr) ? actionstr : "inform", srcip, port);
1341 log_nametypeclass(NO_VERBOSE, txt, qname, qtype, qclass);
1342}
| 1174 actinfo.action = respip_none;
1175
1176 /* If the query for the CNAME target would result in an unusual rcode,
1177 * we generally translate it as a failure for the base query
1178 * (which would then be translated into SERVFAIL). The only exception
1179 * is NXDOMAIN and YXDOMAIN, which are passed to the end client(s).
1180 * The YXDOMAIN case would be rare but still possible (when
1181 * DNSSEC-validated DNAME has been cached but synthesizing CNAME
1182 * can't be generated due to length limitation) */
1183 tgt_rcode = FLAGS_GET_RCODE(tgt_rep->flags);
1184 if((tgt_rcode != LDNS_RCODE_NOERROR &&
1185 tgt_rcode != LDNS_RCODE_NXDOMAIN &&
1186 tgt_rcode != LDNS_RCODE_YXDOMAIN) ||
1187 (must_validate && tgt_rep->security <= sec_status_bogus)) {
1188 return 0;
1189 }
1190
1191 /* see if the target reply would be subject to a response-ip action. */
1192 if(!respip_rewrite_reply(qinfo, cinfo, tgt_rep, &tmp_rep, &actinfo,
1193 &alias_rrset, 1, region, az))
1194 return 0;
1195 if(actinfo.action != respip_none) {
1196 log_info("CNAME target of redirect response-ip action would "
1197 "be subject to response-ip action, too; stripped");
1198 *new_repp = base_rep;
1199 return 1;
1200 }
1201
1202 /* Append target reply to the base. Since we cannot assume
1203 * tgt_rep->rrsets is valid throughout the lifetime of new_rep
1204 * or it can be safely shared by multiple threads, we need to make a
1205 * deep copy. */
1206 new_rep = make_new_reply_info(base_rep, region,
1207 base_rep->an_numrrsets + tgt_rep->an_numrrsets,
1208 base_rep->an_numrrsets);
1209 if(!new_rep)
1210 return 0;
1211 for(i=0,j=base_rep->an_numrrsets; i<tgt_rep->an_numrrsets; i++,j++) {
1212 new_rep->rrsets[j] = copy_rrset(tgt_rep->rrsets[i], region);
1213 if(!new_rep->rrsets[j])
1214 return 0;
1215 }
1216
1217 FLAGS_SET_RCODE(new_rep->flags, tgt_rcode);
1218 *new_repp = new_rep;
1219 return 1;
1220}
1221
1222void
1223respip_inform_super(struct module_qstate* qstate, int id,
1224 struct module_qstate* super)
1225{
1226 struct respip_qstate* rq = (struct respip_qstate*)super->minfo[id];
1227 struct reply_info* new_rep = NULL;
1228
1229 rq->state = RESPIP_SUBQUERY_FINISHED;
1230
1231 /* respip subquery should have always been created with a valid reply
1232 * in super. */
1233 log_assert(super->return_msg && super->return_msg->rep);
1234
1235 /* return_msg can be NULL when, e.g., the sub query resulted in
1236 * SERVFAIL, in which case we regard it as a failure of the original
1237 * query. Other checks are probably redundant, but we check them
1238 * for safety. */
1239 if(!qstate->return_msg || !qstate->return_msg->rep ||
1240 qstate->return_rcode != LDNS_RCODE_NOERROR)
1241 goto fail;
1242
1243 if(!respip_merge_cname(super->return_msg->rep, &qstate->qinfo,
1244 qstate->return_msg->rep, super->client_info,
1245 super->env->need_to_validate, &new_rep, super->region,
1246 qstate->env->auth_zones))
1247 goto fail;
1248 super->return_msg->rep = new_rep;
1249 return;
1250
1251 fail:
1252 super->return_rcode = LDNS_RCODE_SERVFAIL;
1253 super->return_msg = NULL;
1254 return;
1255}
1256
1257void
1258respip_clear(struct module_qstate* qstate, int id)
1259{
1260 qstate->minfo[id] = NULL;
1261}
1262
1263size_t
1264respip_get_mem(struct module_env* env, int id)
1265{
1266 (void)env;
1267 (void)id;
1268 return 0;
1269}
1270
1271/**
1272 * The response-ip function block
1273 */
1274static struct module_func_block respip_block = {
1275 "respip",
1276 &respip_init, &respip_deinit, &respip_operate, &respip_inform_super,
1277 &respip_clear, &respip_get_mem
1278};
1279
1280struct module_func_block*
1281respip_get_funcblock(void)
1282{
1283 return &respip_block;
1284}
1285
1286enum respip_action
1287resp_addr_get_action(const struct resp_addr* addr)
1288{
1289 return addr ? addr->action : respip_none;
1290}
1291
1292struct ub_packed_rrset_key*
1293resp_addr_get_rrset(struct resp_addr* addr)
1294{
1295 return addr ? addr->data : NULL;
1296}
1297
1298int
1299respip_set_is_empty(const struct respip_set* set)
1300{
1301 return set ? set->ip_tree.count == 0 : 1;
1302}
1303
1304void
1305respip_inform_print(struct respip_action_info* respip_actinfo, uint8_t* qname,
1306 uint16_t qtype, uint16_t qclass, struct local_rrset* local_alias,
1307 struct comm_reply* repinfo)
1308{
1309 char srcip[128], respip[128], txt[512];
1310 unsigned port;
1311 struct respip_addr_info* respip_addr = respip_actinfo->addrinfo;
1312 size_t txtlen = 0;
1313 const char* actionstr = NULL;
1314
1315 if(local_alias)
1316 qname = local_alias->rrset->rk.dname;
1317 port = (unsigned)((repinfo->addr.ss_family == AF_INET) ?
1318 ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port) :
1319 ntohs(((struct sockaddr_in6*)&repinfo->addr)->sin6_port));
1320 addr_to_str(&repinfo->addr, repinfo->addrlen, srcip, sizeof(srcip));
1321 addr_to_str(&respip_addr->addr, respip_addr->addrlen,
1322 respip, sizeof(respip));
1323 if(respip_actinfo->rpz_log) {
1324 txtlen += snprintf(txt+txtlen, sizeof(txt)-txtlen, "%s",
1325 "RPZ applied ");
1326 if(respip_actinfo->rpz_cname_override)
1327 actionstr = rpz_action_to_string(
1328 RPZ_CNAME_OVERRIDE_ACTION);
1329 else
1330 actionstr = rpz_action_to_string(
1331 respip_action_to_rpz_action(
1332 respip_actinfo->action));
1333 }
1334 if(respip_actinfo->log_name) {
1335 txtlen += snprintf(txt+txtlen, sizeof(txt)-txtlen,
1336 "[%s] ", respip_actinfo->log_name);
1337 }
1338 snprintf(txt+txtlen, sizeof(txt)-txtlen,
1339 "%s/%d %s %s@%u", respip, respip_addr->net,
1340 (actionstr) ? actionstr : "inform", srcip, port);
1341 log_nametypeclass(NO_VERBOSE, txt, qname, qtype, qclass);
1342}
|